D:\sign_test>makecert -n "cn=root" -r -sv test_root.pvk test_root.cer
Succeeded
D:\sign_test>makecert -n "cn=child" -iv test_root.pvk -ic test_root.cer -sv test_child.pvk test_child.cer
Succeeded

C:\signtest>makecat -v softsigntest.cdf
opened:    softsigntest.cdf
processing: 7zFM
Succeeded

C:\signtest>signtool verify -v -pa -a 7zFM.exe
 
Verifying: 7zFM.exe
File is signed in catalog: C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-
00C04FC295EE}\softsigntest.cat
Signing Certificate Chain:
    Issued to: root
    Issued by: root
    Expires:   2040-1-1 7:59:59
    SHA1 hash: B858A2990D04DED1C72334C9764CB9B0F15DCCC8
 
        Issued to: child
        Issued by: root
        Expires:   2040-1-1 7:59:59
        SHA1 hash: 325ADFF8533B319DD3EF98DB1896FB46456DCD18
 
File is not timestamped.
Successfully verified: 7zFM.exe
 
Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0

BOOL CheckFileTrust( LPCWSTR lpFileName )
{
	BOOL bRet = FALSE;
	WINTRUST_DATA wd = { 0 };
	WINTRUST_FILE_INFO wfi = { 0 };
	WINTRUST_CATALOG_INFO wci = { 0 };
	CATALOG_INFO ci = { 0 };
 
	HCATADMIN hCatAdmin = NULL;
	if ( !CryptCATAdminAcquireContext( &hCatAdmin, NULL, 0 ) )
	{
		return FALSE;
	}
 
	HANDLE hFile = CreateFileW( lpFileName, GENERIC_READ, FILE_SHARE_READ,
		NULL, OPEN_EXISTING, 0, NULL );
	if ( INVALID_HANDLE_VALUE == hFile )
	{
		CryptCATAdminReleaseContext( hCatAdmin, 0 );
		return FALSE;
	}
 
	DWORD dwCnt = 100;
	BYTE byHash[100];
	CryptCATAdminCalcHashFromFileHandle( hFile, &dwCnt, byHash, 0 );
	CloseHandle( hFile );
 
	LPWSTR pszMemberTag = new WCHAR[dwCnt * 2 + 1];
	for ( DWORD dw = 0; dw < dwCnt; ++dw )
	{
		wsprintfW( &pszMemberTag[dw * 2], L"%02X", byHash[dw] );
	}
 
	HCATINFO hCatInfo = CryptCATAdminEnumCatalogFromHash( hCatAdmin,
		byHash, dwCnt, 0, NULL );
	if ( NULL == hCatInfo )   // 编录中没有则验证是否有嵌入式签名
	{
		wfi.cbStruct       = sizeof( WINTRUST_FILE_INFO );
		wfi.pcwszFilePath  = lpFileName;
		wfi.hFile          = NULL;
		wfi.pgKnownSubject = NULL;
 
		wd.cbStruct            = sizeof( WINTRUST_DATA );
		wd.dwUnionChoice       = WTD_CHOICE_FILE;
		wd.pFile               = &wfi;
		wd.dwUIChoice          = WTD_UI_NONE;
		wd.fdwRevocationChecks = WTD_REVOKE_NONE;
		wd.dwStateAction       = WTD_STATEACTION_IGNORE;
		wd.dwProvFlags         = WTD_SAFER_FLAG;
		wd.hWVTStateData       = NULL;
		wd.pwszURLReference    = NULL;
	}
	else  // 编录中有，验证编录文件的签名是否有效
	{
		CryptCATCatalogInfoFromContext( hCatInfo, &ci, 0 );
		wci.cbStruct             = sizeof( WINTRUST_CATALOG_INFO );
		wci.pcwszCatalogFilePath = ci.wszCatalogFile;
		wci.pcwszMemberFilePath  = lpFileName;
		wci.pcwszMemberTag       = pszMemberTag;
 
		wd.cbStruct            = sizeof( WINTRUST_DATA );
		wd.dwUnionChoice       = WTD_CHOICE_CATALOG;
		wd.pCatalog            = &wci;
		wd.dwUIChoice          = WTD_UI_NONE;
		wd.fdwRevocationChecks = WTD_STATEACTION_VERIFY;
		wd.dwProvFlags         = 0;
		wd.hWVTStateData       = NULL;
		wd.pwszURLReference    = NULL;
	}
	GUID action = WINTRUST_ACTION_GENERIC_VERIFY_V2;
	HRESULT hr  = WinVerifyTrust( NULL, &action, &wd );
	bRet        = SUCCEEDED( hr );
 
	if ( NULL != hCatInfo )
	{
		CryptCATAdminReleaseCatalogContext( hCatAdmin, hCatInfo, 0 );
	}
	CryptCATAdminReleaseContext( hCatAdmin, 0 );
	delete[] pszMemberTag;
	return bRet;
}

typedef struct _IMAGE_DATA_DIRECTORY {
	DWORD   VirtualAddress;  // PE文件的偏移
	DWORD   Size;
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
 
typedef struct _WIN_CERTIFICATE
{
	DWORD       dwLength; // WIN_CERTIFICATE 的长度（含bCertificate的大小）
	WORD        wRevision;
	WORD        wCertificateType;
	BYTE        bCertificate[ANYSIZE_ARRAY]; // signedData开始的位置
 
} WIN_CERTIFICATE, *LPWIN_CERTIFICATE;

SignedData ::= SEQUENCE {
  version Version,
  digestAlgorithms DigestAlgorithmIdentifiers,
  contentInfo ContentInfo,  -- 这个里面包含了PE文件的Hash
  certificates  --证书的数组（不包括根证书）
    	[0] IMPLICIT ExtendedCertificatesAndCertificates
       OPTIONAL,
  Crls
    [1] IMPLICIT CertificateRevocationLists OPTIONAL,
  signerInfos SignerInfos }  -- 签名者的信息
 
SignerInfos ::= SET OF SignerInfo

SignerInfo ::= SEQUENCE {
  version Version,
  issuerAndSerialNumber IssuerAndSerialNumber,
  digestAlgorithm DigestAlgorithmIdentifier,
  authenticatedAttributes -- 内含SignedData中contentInfo的摘要
    [0] IMPLICIT Attributes OPTIONAL,
  digestEncryptionAlgorithm
    DigestEncryptionAlgorithmIdentifier,
  encryptedDigest EncryptedDigest, -- 加密后的摘要
  unauthenticatedAttributes
    [1] IMPLICIT Attributes OPTIONAL }
IssuerAndSerialNumber ::= SEQUENCE {
  issuer Name,
  serialNumber CertificateSerialNumber }
EncryptedDigest ::= OCTET STRING

   DigestInfo ::= SEQUENCE {
     digestAlgorithm DigestAlgorithmIdentifier,
     digest Digest }
 
   Digest ::= OCTET STRING

   -- X509的证书格式
   Certificate  ::=  SEQUENCE  {
        tbsCertificate       TBSCertificate,   -- 证书主体
        signatureAlgorithm   AlgorithmIdentifier,  -- 签名用的算法，一般为sha1RSA
        signatureValue       BIT STRING  }     -- 证书的签名
 
   TBSCertificate  ::=  SEQUENCE  {
        version         [0]  EXPLICIT Version DEFAULT v1, -- PE文件数字签名用的版本为3
        serialNumber         CertificateSerialNumber,
        signature            AlgorithmIdentifier,
        issuer               Name,
        validity             Validity, -- 有效期
        subject              Name,
        subjectPublicKeyInfo SubjectPublicKeyInfo,  -- 含有这个证书的公钥
        issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
                             -- If present, version MUST be v2 or v3        
        subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
                             -- If present, version MUST be v2 or v3
        extensions      [3]  EXPLICIT Extensions OPTIONAL  -- 扩展
                             -- If present, version MUST be v3
        }
 
   -- 含有公钥的信息
   SubjectPublicKeyInfo  ::=  SEQUENCE  {
        algorithm            AlgorithmIdentifier,
        subjectPublicKey     BIT STRING  }

   AuthorityKeyIdentifier ::= SEQUENCE {
      keyIdentifier             [0] KeyIdentifier           OPTIONAL,
      authorityCertIssuer       [1] GeneralNames            OPTIONAL,
      authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL  }
 
   KeyIdentifier ::= OCTET STRING
 
   SubjectKeyIdentifier ::= KeyIdentifier

ContentInfo ::= SEQUENCE {
  contentType ContentType,
  content
    [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL 
}

SpcIndirectDataContent ::= SEQUENCE {
    data                    SpcAttributeTypeAndOptionalValue,
    messageDigest           DigestInfo
} --#public—
 
DigestInfo ::= SEQUENCE {
    digestAlgorithm     AlgorithmIdentifier,
    digest              OCTETSTRING
}

do 
{
	LPWIN_CERTIFICATE pCert;
	// .. 省略代码，从PE文件获取pCert 的地址	 
	const unsigned char* pCertificate = pCert->bCertificate; 
	DWORD dwPKCS7Len = pCert->dwLength - offsetof(WIN_CERTIFICATE, bCertificate);
	PKCS7* pPkcs7 = d2i_PKCS7(NULL, &pCertificate, dwPKCS7Len);  // DER编码转换为openssl的内部格式
 
 
	// 获取PE文件的摘要，这个可以直接调用CryptCATAdminCalcHashFromFileHandle，也可以按照文档的描述来自己计算
	CAutoVectorPtr pSignSha1;
	DWORD dwSignSha1Len = 0;
	GetFileHashForSign(lpszPEPath, pSignSha1, dwSignSha1Len);
 
	// 对比文件的HASH与签名中的hash，抄来的代码
	BOOL bMathc = IsHashMatch(pPkcs7, pSignSha1, dwSignSha1Len);
	if (!bTmp)
	{
		cout << endl << "PE Image Hash dismatch" << endl;
		break;
	}
	cout << "PE Image Hash match" << endl;
 
	// 把根证书放到X509_STORE中
	X509_STORE *pX509Store = X509_STORE_new();
	AddRootCerToStore(pX509Store, lpszCertPath);
	X509_STORE_set_purpose(pX509Store, X509_PURPOSE_ANY);
 
	// PKCS7_verify 验证的时候是把内容当做V_ASN1_OCTET_STRING 来验证的，
	// 但PE文件的数字签名里这里是一个V_ASN1_SEQUENCE
	// 所以需要手动把V_ASN1_SEQUENCE 的内容取出来放到BIO 里面给PKCS7_verify 来验证
	// 毕竟openssl不是为了PE文件数字签名验证写的，用起来还是有点别扭的
	cout << "Verifying PKCS #7..."; 	int seqhdrlen = asn1_simple_hdr_len(pPkcs7->d.sign->contents->d.other->value.sequence->data,
		pPkcs7->d.sign->contents->d.other->value.sequence->length);
	BIO* pContentBio = BIO_new_mem_buf(pPkcs7->d.sign->contents->d.other->value.sequence->data + seqhdrlen,
		pPkcs7->d.sign->contents->d.other->value.sequence->length - seqhdrlen);
 
 
	// 校验数字签名
	int nOk = PKCS7_verify(pPkcs7, pPkcs7->d.sign->cert, pX509Store, pContentBio, NULL, PKCS7_NOCRL);
	if (1 != nOk)
	{
		cout << "failed" << endl;
	}
	else
	{
		cout << "ok" << endl;
	}
 
} while (0);